CVE-2017-17847
HighSummary
An issue was discovered in Enigmail before 1.9.9 related to signature spoofing. The UI does not properly distinguish between an attachment signature and a signature that applies to the entire containing message, which may lead to unauthorized message authentication.
Risk Assessment
Organizations may be vulnerable to attacks that mislead users, potentially resulting in the disclosure of sensitive information or fraud.
Recommendation
It is recommended to update Enigmail to version 1.9.9 or later to mitigate the risks associated with signature spoofing.
Other vulnerabilities in Enigmail
See all- CVE-2017-17848High
An issue was discovered in Enigmail before version 1.9.9 related to signature spoofing in multipart/related messages. A signed message part can be referenced with a cid: URI but not actually displayed, leading to the entire message appearing signed while the recipient does not see any of the signed text.
- CVE-2017-17846High
An issue was discovered in Enigmail before 1.9.9 related to regular expressions that can be exploited for Denial of Service by attempting to match arbitrarily long strings.
- CVE-2017-17845High
An issue was discovered in Enigmail before 1.9.9 related to improper random secret generation. The use of Math.Random() by pretty Easy privacy (pEp) leads to this vulnerability.
Original NVD description (English source)
An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.